yj;0dZddlmZddlZddlZddlZddlZddlmZm Z m Z dZ dZ d&d Z d'd(d Zd)d Zd*dZd+dZd,dZd-dZd+dZd.dZd/dZd0d Zd!dd"d1d%ZdS)2z0Shared helpers for direct xAI HTTP integrations.) annotationsN)AnyDictOptionali'ireturnboolc ddlm}|ddpdrdSnE#t$r8tjddrYdSYnwxYw ddlm}|dz }| sdStj | d }t|tr|d nd }t|tr|d nd }t|tr|dnd }t|tr|dnd }t|pdrdSt|tr|dnd }t|tr|d nd } t| t rU| D]R} t| tst| ddpdrdSSdS#t"$rYdSwxYw)uCheap probe — return True when xAI credentials are *likely* usable. Deliberately avoids :func:`resolve_xai_http_credentials` so callers in hot-paint paths (``hermes tools`` repaint, tool-registration scans, ``WebSearchProvider.is_available()``) don't incur disk locks or — in the OAuth path — a network token refresh. The ABC contract on :meth:`agent.web_search_provider.WebSearchProvider.is_available` explicitly forbids network calls for exactly this reason. Resolution order, fast-to-slow: 1. ``XAI_API_KEY`` env var (cheapest; covers explicit-key users). 2. ``~/.hermes/auth.json`` has a non-empty ``providers.xai-oauth.tokens.access_token`` (single file read, no expiry check, no refresh). 3. ``credential_pool.xai-oauth`` has any entry with a non-empty ``access_token`` (covers multi-account ``hermes auth add xai-oauth`` grants that are pool-only / ``manual:device_code``). Returns False on any exception so a corrupted auth store can't block other availability scans. Truthful refresh + expiry handling happens in ``search()`` (or whichever caller actually makes the request). r) get_secret XAI_API_KEYTget_hermes_homez auth.jsonFz utf-8-sigencoding providersN xai-oauthtokens access_tokencredential_pool)agent.secret_scoper strip ImportErrorosenvirongethermes_constantsrexistsjsonloads read_text isinstancedictstrlist Exception) r r auth_pathstorer xai_staterrrentriesentrys 4/home/ragecks/.hermes/hermes-agent/tools/xai_http.pyhas_xai_credentialsr,s.111111 J}b ) ) /R 6 6 8 8 4   :>>- , , 2 2 4 4 44   444444#O%% 3 !! 5 9.. .DDEE.8.E.EOEIIk***4 2Return a stable Hermes-specific User-Agent for xAI HTTP calls.r __version__unknownz Hermes-Agent/) hermes_clir6r%r5s r+hermes_xai_user_agentr9_sN *******      (; ( ((s  Dict[str, str]c"dtiS)u5Default headers for OpenAI-SDK and raw HTTP clients talking to xAI. Replaces the OpenAI Python SDK's identifying ``User-Agent: OpenAI/Python …`` so chat/completions and Responses traffic is attributed as Hermes Agent, matching the direct HTTP integrations (search, TTS, STT, image, video). z User-Agent)r9r+hermes_xai_default_headersr>hs /11 22r= section_nameDict[str, Any]c ddlm}|}t|tr||nd}t|tr|niS#t $ricYSwxYw)z=Return a top-level Hermes config section as a dict, or empty.r) load_configN)r0rBr!r"rr%)r?rBcfgsections r+_load_config_sectionrErs111111kmm+5c4+@+@J#'','''d$Wd33;ww;  sAA A&%A&r3rr1ct|tr|St|tr2|}|dvrdS|dvrdS|S)N>1onyestrueenabledT>0noofffalsedisabledF)r!rr#rlower)r3r1 normalizeds r+ _coerce_boolrS~sk% %[[]]((** > > >4 @ @ @5 Nr= Optional[int]c|dSt|trZ|}|dvrdS|dvrdS t |}n#t $r t cYSwxYwt|ttfr,t |}|dkrdSt|tSt S)zNormalize an xAI storage TTL. Returns: int seconds for an expiring file, None for permanent storage (omit expires_after on the wire). N>r r1>rLnonenullneverforever permanentr) r!r#rrQint ValueError&SAFE_XAI_STORAGE_EXPIRES_AFTER_SECONDSfloatmin%MAX_XAI_STORAGE_EXPIRES_AFTER_SECONDS)r3rRsecondss r+_coerce_expires_afterrbs }t% :[[]]((**  ( (4 O O O4 : OOEE : : :9 9 9 9 :%#u&&Ce** a<<47ABBB 11s AA10A1ct|}t|tr|dnd}t|tr|dnd}t|tr|ni}t |dd}t |dd}t |d}|||dS) aRead storage settings for xAI Imagine under image_gen/video_gen config. Supported config shape: image_gen: xai: storage: enabled: true public_url: true expires_after: null # omit for permanent public URLs The same shape is accepted under ``video_gen.xai.storage``. Storage is on by default so xAI returns permanent public URLs instead of short-lived CDN URLs. xaiNstoragerKT public_url expires_after)rKrfrg)rEr!r"rrSrb)r?rD xai_sectionrerKrfrgs r+read_xai_imagine_storage_configris#<00G(27D(A(AK'++e$$$tK,6{D,I,ISkooi(((tG#GT22:ggG7;;y11488Ggkk,77>>J)'++o*F*FGGM &  r=filename_prefix extensionOptional[Dict[str, Any]]ct|}|dsdStjtj}|d}t jjdd}|dpd}|d|d|d|t|dd }|d  |d |d <|S) zAReturn an xAI ``storage_options`` payload, or None when disabled.rKNz %Y%m%d-%H%M%S.bin-rf)filenamerfrg) ridatetimenowUTCstrftimeuuiduuid4hexlstripr) r?rjrkrCrttsshortextpayloads r+build_xai_storage_optionsrs *, 7 7C y>t     - -C o & &B JLL RaR E   3   (5C&;;;;e;;c;;3|,--G ?'#&#7 Nr=ct|}|dsdS|dd}n|ddz }d|dd |d krd nd}d |d |dS)z5User-facing notice for first xAI Imagine storage use.rKr rgNzwithout an automatic expiryiQz for about gz dayszMxAI Imagine storage is enabled so generated media gets a reusable public URL zK. xAI may bill for stored files and public URL hosting. Disable this with `zL.xai.storage.enabled: false` or set `expires_after` to change the retention.)ri)r?rC retentiondayss r+xai_storage_notice_textrs ), 7 7C y>r ?#1 ?#|4GGGGDAIISS2GG  : : :'3 : : :r= Optional[str]ct|}|sdS ddlm}|dz }|dd||dz }|rdS|t jt j dzd |S#t$r|cYSwxYw) zBReturn the storage notice once per Hermes home, then mark it seen.Nrr stateT)parentsexist_ok_xai_storage_notice_seen zutf-8r) rrrmkdirr write_textrsrtru isoformatr%)r?noticer marker_dirmarkers r+"maybe_mark_xai_storage_notice_seenrs $\ 2 2F t 444444$_&&0 555GGGG ==?? 4(+// ==GGIIDP[bccc  sAB2AB22 CCF) force_refresh api_key_hintrrc< ddlm}ddlm}|d}|r||n|}|r||}t t|ddpt|dd}t t|ddpt|d dp|j  d }t td ptd pd d }| || } |rd|| dSn#t$rYnwxYw ddlm} | ddt} n@#t $r3t tdpd} YnwxYwt td pd d } d| | dS)u;Resolve bearer credentials for direct xAI HTTP endpoints. Prefers Hermes-managed xAI OAuth credentials when available, then falls back to ``XAI_API_KEY`` resolved via ``hermes_cli.config.get_env_value`` so keys stored in ``~/.hermes/.env`` (the standard Hermes location) are honored — not just ones already exported into ``os.environ``. This keeps direct xAI endpoints (images, TTS, STT, etc.) aligned with the main runtime auth model and preserves the regression contract from PR #17140 / #17163. Set ``force_refresh=True`` to perform an unconditional OAuth refresh. Reactive callers should also pass the rejected bearer as ``api_key_hint`` so a freshly loaded multi-account pool refreshes the exact issuing entry, not whichever entry its strategy would otherwise select first. r) load_poolNrruntime_api_keyrr runtime_base_urlbase_url/HERMES_XAI_BASE_URL XAI_BASE_URL)fallback)providerapi_keyr)resolve_provider_secretr rd) env_getterzhttps://api.x.ai/v1)agent.credential_poolrhermes_cli.authauthtry_refresh_matchingselectr#getattrrDEFAULT_XAI_OAUTH_BASE_URLrstripr/ _xai_validate_inference_base_urlr%tools.tool_backend_helpersrr) rrrauth_modpoolr*rfallback_base_urloverride_base_urlrrrs r+resolve_xai_http_credentialsrs&( 333333******y%% D % %l 3 3 3   "U]KKMME E,d 3 3 2unb11   %''  E-t 4 4 3uj"-- 32   %''&&++   / 0 0 ^,,    %''&&++  << &=    ''$        BFFFFFF))-=YYY BBBmM228b99??AAB=00I4IJJPPRRYYZ]^^H  s$E&E** E76E7;F:GG)rr)N)r-r#)rr#)rr:)r?r#rr@)r3rr1rrr)r3rrrT)r?r#rjr#rkr#rrl)r?r#rr#)r?r#rr)rrrrrr:)__doc__ __future__rrsrrrwtypingrrrr`r]r,r/r9r>rErSrbrirrrrr<r=r+rs66"""""" &&&&&&&&&&):%)9&<<<<~ 3 3 3 3 3 ))))3333        22226>0$* "&HHHHHHHHr=